x86 Paging Tutorial Updated 2025-07-19
This tutorial explains the very basics of how paging works, with focus on x86, although most high level concepts will also apply to other instruction set architectures, e.g. ARM.
The goals are to:
  • demonstrate minimal concrete simplified paging examples that will be useful to those learning paging for the first time
  • explain the motivation behind paging
This tutorial was extracted and expanded from this Stack Overflow answer.
64 bits is still too much address for current RAM sizes, so most architectures will use less bits.
x86_64 uses 48 bits (256 TiB), and legacy mode's PAE already allows 52-bit addresses (4 PiB). 56-bits is a likely future candidate.
12 of those 48 bits are already reserved for the offset, which leaves 36 bits.
If a 2 level approach is taken, the best split would be two 18 bit levels.
But that would mean that the page directory would have 2^18 = 256K entries, which would take too much RAM: close to a single-level paging for 32 bit architectures!
Therefore, 64 bit architectures create even further page levels, commonly 3 or 4.
x86_64 uses 4 levels in a 9 | 9 | 9 | 9 scheme, so that the upper level only takes up only 2^9 higher level entries.
The 48 bits are split equally into two disjoint parts:
----------------- FFFFFFFF FFFFFFFF
Top half
----------------- FFFF8000 00000000


Not addressable


----------------- 00007FFF FFFFFFFF
Bottom half
----------------- 00000000 00000000
A 5-level scheme is emerging in 2016: software.intel.com/sites/default/files/managed/2b/80/5-level_paging_white_paper.pdf which allows 52-bit addresses with 4k pagetables.
Page directory given to process by the OS:
entry index   entry address      page table address  present
-----------   ----------------   ------------------  --------
0             CR3 + 0      * 4   0x10000             1
1             CR3 + 1      * 4                       0
2             CR3 + 2      * 4   0x80000             1
3             CR3 + 3      * 4                       0
...
2^10-1        CR3 + 2^10-1 * 4                       0
Page tables given to process by the OS at PT1 = 0x10000000 (0x10000 * 4K):
entry index   entry address      page address  present
-----------   ----------------   ------------  -------
0             PT1 + 0      * 4   0x00001       1
1             PT1 + 1      * 4                 0
2             PT1 + 2      * 4   0x0000D       1
...                                  ...
2^10-1        PT1 + 2^10-1 * 4   0x00005       1
Page tables given to process by the OS at PT2 = 0x80000000 (0x80000 * 4K):
entry index   entry address     page address  present
-----------   ---------------   ------------  ------------
0             PT2 + 0     * 4   0x0000A       1
1             PT2 + 1     * 4   0x0000C       1
2             PT2 + 2     * 4                 0
...
2^10-1        PT2 + 0x3FF * 4   0x00003       1
where PT1 and PT2: initial position of page table 1 and page table 2 for process 1 on RAM.
With that setup, the following translations would happen:
linear    10 10 12 split  physical
--------  --------------  ----------
00000001  000 000 001     00001001
00001001  000 001 001     page fault
003FF001  000 3FF 001     00005001
00400000  001 000 000     page fault
00800001  002 000 001     0000A001
00801004  002 001 004     0000C004
00802004  002 002 004     page fault
00B00001  003 000 000     page fault
Let's translate the linear address 0x00801004 step by step:
  • In binary the linear address is:
    0    0    8    0    1    0    0    4
    0000 0000 1000 0000 0001 0000 0000 0100
  • Grouping as 10 | 10 | 12 gives:
    0000000010 0000000001 000000000100
    0x2        0x1        0x4
    which gives:
    page directory entry = 0x2
    page table     entry = 0x1
    offset               = 0x4
    So the hardware looks for entry 2 of the page directory.
  • The page directory table says that the page table is located at 0x80000 * 4K = 0x80000000. This is the first RAM access of the process.
    Since the page table entry is 0x1, the hardware looks at entry 1 of the page table at 0x80000000, which tells it that the physical page is located at address 0x0000C * 4K = 0x0000C000. This is the second RAM access of the process.
  • Finally, the paging hardware adds the offset, and the final address is 0x0000C004.
Page faults occur if either a page directory entry or a page table entry is not present.
The Intel manual gives a picture of this translation process in the image "Linear-Address Translation to a 4-KByte Page using 32-Bit Paging": Figure 1. "x86 page translation process"
Figure 1.
x86 page translation process
.
x86 Paging Tutorial / Application Updated 2025-07-16
Paging makes it easier to compile and run two programs or threads at the same time on a single computer.
For example, when you compile two programs, the compiler does not know if they are going to be running at the same time or not.
So nothing prevents it from using the same RAM address, say, 0x1234, to store a global variable.
And thread stacks, that must be contiguous and keep growing down until they overwrite each other, are an even bigger issue!
But if two programs use the same address and run at the same time, this is obviously going to break them!
Paging solves this problem beautifully by adding one degree of indirection:
(logical) ------------> (physical)
             paging
Where:
  • logical addresses are what userland programs see, e.g. the contents of rsi in mov eax, [rsi].
    They are often called "virtual" addresses as well.
  • physical addresses can be though of the values that go to physical RAM index wires.
    But keep in mind that this is not 100% true because of further indirections such as:
Compilers don't need to worry about other programs: they just use simple logical addresses.
As far as programs are concerned, they think they can use any address between 0 and 4 GiB (2^32, FFFFFFFF) on 32-bit systems.
The OS then sets up paging so that identical logical addresses will go into different physical addresses and not overwrite each other.
This makes it much simpler to compile programs and run them at the same time.
Paging achieves that goal, and in addition:
  • the switch between programs is very fast, because it is implemented by hardware
  • the memory of both programs can grow and shrink as needed without too much fragmentation
  • one program can never access the memory of another program, even if it wanted to.
    This is good both for security, and to prevent bugs in one program from crashing other programs.
Or if you like non-funny jokes:
Figure 1.
Comparison between the Linux kernel userland memory virtualization and The Matrix
. Source. Is this RAM real?
x86 Paging Tutorial / CAM Updated 2025-07-16
Using the TLB makes translation faster, because the initial translation takes one access per TLB level, which means 2 on a simple 32 bit scheme, but 3 or 4 on 64 bit architectures.
The TLB is usually implemented as an expensive type of RAM called content-addressable memory (CAM). CAM implements an associative map on hardware, that is, a structure that given a key (linear address), retrieves a value.
Mappings could also be implemented on RAM addresses, but CAM mappings may required much less entries than a RAM mapping.
For example, a map in which:
  • both keys and values have 20 bits (the case of a simple paging schemes)
  • at most 4 values need to be stored at each time
could be stored in a TLB with 4 entries:
linear  physical
------  --------
00000   00001
00001   00010
00010   00011
FFFFF   00000
However, to implement this with RAM, it would be necessary to have 2^20 addresses:
linear  physical
------  --------
00000   00001
00001   00010
00010   00011
... (from 00011 to FFFFE)
FFFFF   00000
which would be even more expensive than using a TLB.
Paging is implemented by the CPU hardware itself.
Paging could be implemented in software, but that would be too slow, because every single RAM memory access uses it!
Operating systems must setup and control paging by communicating to the CPU hardware. This is done mostly via:
Processes can however make requests to the OS that cause the page tables to be modified, notably:
The kernel then decides if the request will be granted or not in a controlled manner.
x86's multi-level paging scheme uses a 2 level K-ary tree with 2^10 bits on each level.
Addresses are now split as:
| directory (10 bits) | table (10 bits) | offset (12 bits) |
Then:
  • the top 10 bits are used to walk the top level of the K-ary tree (level0)
    The top table is called a "directory of page tables".
    cr3 now points to the location on RAM of the page directory of the current process instead of page tables.
    Page directory entries are very similar to page table entries except that they point to the physical addresses of page tables instead of physical addresses of pages.
    Each directory entry also takes up 4 bytes, just like page entries, so that makes 4 KiB per process minimum.
    Page directory entries also contain a valid flag: if invalid, the OS does not allocate a page table for that entry, and saves memory.
    Each process has one and only one page directory associated to it (and pointed to by cr3), so it will contain at least 2^10 = 1K page directory entries, much better than the minimum 1M entries required on a single-level scheme.
  • the next 10 bits are used to walk the second level of the K-ary tree (level1)
    Second level entries are also called page tables like the single level scheme.
    Page tables are only allocated only as needed by the OS.
    Each page table has only 2^10 = 1K page table entries instead of 2^20 for the single paging scheme.
    Each process can now have up to 2^10 page tables instead of 2^20 for the single paging scheme.
  • the offset is again not used for translation, it only gives the offset within a page
One reason for using 10 bits on the first two levels (and not, say, 12 | 8 | 12 ) is that each Page Table entry is 4 bytes long. Then the 2^10 entries of Page directories and Page Tables will fit nicely into 4Kb pages. This means that it faster and simpler to allocate and deallocate pages for that purpose.
The Linux kernel makes extensive usage of the paging features of x86 to allow fast process switches with small data fragmentation.
There are also however some features that the Linux kernel might not use, either because they are only for backwards compatibility, or because the Linux devs didn't feel it was worth it yet.
The same linear address can translate to different physical addresses for different processes, depending only on the value inside cr3.
Both linear addresses 00002 000 from process 1 and 00004 000 from process 2 point to the same physical address 00003 000. This is completely allowed by the hardware, and it is up to the operating system to handle such cases.
This often in normal operation because of Copy-on-write (COW), which be explained elsewhere.
Such mappings are sometime called "aliases".
Suppose that the OS has setup the following page tables for process 1:
entry index   entry address       page address   present
-----------   ------------------  ------------   -------
0             CR3_1 + 0      * 4  0x00001        1
1             CR3_1 + 1      * 4  0x00000        1
2             CR3_1 + 2      * 4  0x00003        1
3             CR3_1 + 3      * 4                 0
...
2^20-1        CR3_1 + 2^20-1 * 4  0x00005        1
and for process 2:
entry index   entry address       page address   present
-----------   -----------------   ------------   -------
0             CR3_2 + 0      * 4  0x0000A        1
1             CR3_2 + 1      * 4  0x12345        1
2             CR3_2 + 2      * 4                 0
3             CR3_2 + 3      * 4  0x00003        1
...
2^20-1        CR3_2 + 2^20-1 * 4  0xFFFFF        1
Before process 1 starts running, the OS sets its cr3 to point to the page table 1 at CR3_1.
When process 1 tries to access a linear address, this is the physical addresses that will be actually accessed:
linear     physical
---------  ---------
00000 001  00001 001
00000 002  00001 002
00000 003  00001 003
00000 FFF  00001 FFF
00001 000  00000 000
00001 001  00000 001
00001 FFF  00000 FFF
00002 000  00003 000
FFFFF 000  00005 000
To switch to process 2, the OS simply sets cr3 to CR3_2, and now the following translations would happen:
linear     physical
---------  ---------
00000 002  0000A 002
00000 003  0000A 003
00000 FFF  0000A FFF
00001 000  12345 000
00001 001  12345 001
00001 FFF  12345 FFF
00004 000  00003 000
FFFFF 000  FFFFF 000
Step-by-step translation for process 1 of logical address 0x00000001 to physical address 0x00001001:
  • split the linear address into two parts:
    | page (20 bits) | offset (12 bits) |
    So in this case we would have:
    *page = 0x00000. This part must be translated to a physical location.
    *offset = 0x001. This part is added directly to the page address, and is not translated: it contains the position within the page.
  • look into Page table 1 because cr3 points to it.
  • The hardware knows that this entry is located at RAM address CR3 + 0x00000 * 4 = CR3:
    *0x00000 because the page part of the logical address is 0x00000
    *4 because that is the fixed size in bytes of every page table entry
  • since it is present, the access is valid
  • by the page table, the location of page number 0x00000 is at 0x00001 * 4K = 0x00001000.
  • to find the final physical address we just need to add the offset:
      00001 000
    + 00000 001
      ---------
      00001 001
    because 00001 is the physical address of the page looked up on the table and 001 is the offset.
    We shift 00001 by 12 bits because the pages are always aligned to 4 KiB.
    The offset is always simply added the physical address of the page.
  • the hardware then gets the memory at that physical location and puts it in a register.
Another example: for logical address 0x00001001:
  • the page part is 00001, and the offset part is 001
  • the hardware knows that its page table entry is located at RAM address: CR3 + 1 * 4 (1 because of the page part), and that is where it will look for it
  • it finds the page address 0x00000 there
  • so the final address is 0x00000 * 4k + 0x001 = 0x00000001
Xah Lee Updated 2025-07-16
fuseki.net/home/List-of-Patreon-Subs-with-Justification.html describes him well:
Outsider, formerly homeless, extreme person interested in CS and culture. Self-publishes a website with thousands of tutorial / opinion pages. Possibly similar to Sam Sloan - extremely productive, wide interests, obsessive, and pretty disagreeable.
Homepage xahlee.org/ says:
Siphon my knowledge into your brain. Assimilate my sensibilities to your spine.
Nice Second brain vibe.
Figure 1.
Xah Lee with some weird statuettes of himself
. Source. 2019.
Let's see:
Yang-Mills existence and mass gap Updated 2025-07-16
Video 1.
Yang-Mills 1 by David Metzler (2011)
Source.
A bit disappointing, too high level, with very few nuggests that are not Googleable withing 5 minutes.
Breakdown:
Video 2. Source. 2 hour talk at the Kavli Institute for Theoretical Physics. Too mathematical, 2021 Ciro can't make much out of it.
Video 3.
Lorenzo Sadun on the "Yang-Mills and Mass Gap" Millennium problem
. Source. Unknown year. He almost gets there, he's good. Just needed to be a little bit deeper.
Students choose only one of the Cx courses.
Then there are PhDs corresponding to each of them: www.ox.ac.uk/admissions/graduate/courses/mpls/physics
Zeeman effect Updated 2025-07-16
Split in the spectral line when a magnetic field is applied.
Non-anomalous: number of splits matches predictions of the Schrödinger equation about the number of possible states with a given angular momentum. TODO does it make numerical predictions?
www.pas.rochester.edu/~blackman/ast104/zeeman-split.html contains the hello world that everyone should know: 2p splits into 3 energy levels, so you see 3 spectral lines from 1s to 2p rather than just one.
p splits into 3, d into 5, f into 7 and so on, i.e. one for each possible azimuthal quantum number.
It also mentions that polarization effects become visible from this: each line is polarized in a different way. TODO more details as in an experiment to observe this.
Video 1.
Experimental physics - IV: 22 - Zeeman effect by Lehrportal Uni Gottingen (2020)
Source.
This one is decent. Uses a cadmium lamp and an etalon on an optical table. They see a more or less clear 3-split in a circular interference pattern,
They filter out all but the transition of interest.
Video 2.
Zeeman Effect - Control light with magnetic fields by Applied Science (2018)
Source. Does not appear to achieve a crystal clear split unfortunately.
ZX-calculus Updated 2025-07-16
How can we easily prove that that quantum circuit equals the state:
?
The naive way would be to just do the matrix multiplication as explained at Section "Quantum computing is just matrix multiplication".
However, ZX-calculus provides a simpler way.
And even more importantly, sometimes it is the only way, because in a real circuit, we would not be able to do the matrix multiplication
What we do in ZX-calculus is we first transform the original quantum circuit into a ZX graph.
This is always possible, because we can describe how to do the conversion simply for any of the Clifford plus T gates, which is a set of universal quantum gates.
Then, after we do this transformation, we can start applying further transformations that simplify the circuit.
It has already been proven that there is no efficient algorithm for this (TODO source, someone said P-sharp complete best case)
But it has been proven in 2017 that any possible equivalence between quantum circuits can be reached by modifying ZX-calculus circuits.
There are only 7 transformation rules that we need, and all others can be derived from those, universality.
So, we can apply those rules to do the transformation shown in Wikipedia:
Figure 1.
GHZ circuit as ZX-diagram
. Source.
and one of those rules finally tells us that that last graph means our desired state:
because it is a Z spider with and .
Video 1.
Working with PyZX by Aleks Kissinger (2019)
Source. This video appears to give amazing motivation on why you should care about ZX-calculus, it mentions
ZynAddSubFX Updated 2025-07-16
Contains a large database of instruments, and allows you to edit them. This is a fun toy.
Instruments are edited on a GUI. It is a multi-window program, and you open new windows from new windows from new windows, all filled with hundreds of virtual knobs that you drag with your keyboard, and which would be better done from textual software like Csound. It is a thing of beauty.
It does not seem possible to program arbitrary modular synthesizer circuits therefore. But if you understand additive synthesis and subtractive synthesis well, you can make some funky sounds with it.
It is basically a superset of all popular hardware synthesizers ever made.
Has its own built-in MIDI keyboard which is nice.
On Ubuntu 20.04 Version: 3.0.5:
sudo apt install zynaddsubfx
zynaddsubfx -O alsa
as per askubuntu.com/questions/220802/no-sound-zynaddsubfx-and-jack-wont-run/1297988#1297988
To do anything of interest, switch to the Advanced UI:
The UI is completely different form what is shown on the website as of 2020: zynaddsubfx.sourceforge.io/, it looks instead like: www.youtube.com/watch?v=iVPr6iUuO3g Maybe on the website it is the new zyn-fusion UI... www.reddit.com/r/linuxaudio/comments/bxn3ur/some_help_for_installing_zynfusion_zynaddsubfx/ so confusing.
And they have some crappy policy of asking for 45 USD for binary downloads.
Compiling from source:
git clone https://github.com/zynaddsubfx/zynaddsubfx
cd zynaddsubfx
git checkout a789866de4d45a784c1f4d95fcf5a1938347baef
sudo apt build-dep zynaddsubfx
mkdir build
cd build
cmake ..
make -j`nproc`
fails with:
Traceback (most recent call last):
  File "/usr/bin/cxxtestgen", line 7, in <module>
    import cxxtest.cxxtestgen
  File "/usr/share/cxxtest/cxxtest/__init__.py", line 33, in <module>
    from cxxtest.cxxtestgen import *
  File "/usr/share/cxxtest/cxxtest/cxxtestgen.py", line 18, in <module>
    import __release__
ModuleNotFoundError: No module named '__release__'
Ciro gives up for now.
OurBigBook.com Updated 2025-10-27
The website is the reference instance of OurBigBook Web, which is part of the OurBigBook Project, the other main part of the project are software that users can run locally to publish their content such as the OurBigBook CLI.
This page contains further information about the project's rationale, motivation and planning.
Video 1.
Intro to the OurBigBook Project
. Source.
Figure 1.
The topics feature allows you to find the best version of a subject written by other users user
. Live demo: derivative.
Figure 2.
Take a look at my GitHub, there are great projects!
OurBigBook's weird specialization towards the weird overly niche interests of its creator Ciro Santilli, notably "I want to create the perfect documentation for every atom in the universe, is undoubtedly partly to blame for the project's failure to gain even a single user outside of its own creator.
However, Ciro does also believe that innovation requires to some degree specializing weirdly in some niche direction. Success comes perhaps from both going into a novel and valuable direction, while still being anatomic enough for enough people.
Asian fetish Updated 2025-10-27
All interests are based on fetishes.
The fetish of beauty. The fetish if intelligence. The fetish of kindness.
What's wrong with the fetish of Asianess?
Whenever Ciro's wife starts with "the Asian fetish talk", Ciro reminds her of her own claimed "tall person fetish", and they call it quits.
Asian fetish is much more than sex. It is about the culture, the history, the language. It is the same fetish that makes great mathematicians an Artists do what they do.
When Ciro Santilli was at École Polytechnique, he had to do a presentation for his stupid English courses that all students were forced to take, no matter how good their English was.
The topic was likely something like "pick a country", and Ciro was delighted when he managed to pick "China", after it had gone around a table with many many people before him.
The PowerPoint presentation Ciro made over the weekend was so amazing (and making it was actually fun to make, Ciro actually remembers it a bit!), drawing partly from stuff his wife then girlfriend showed him, that at the end the one of the other students asked him if he had lived in China.
It is a shame Ciro couldn't find the presentation when he wrote this line many many years later. Anything that is not in a BLOB-free monorepo, will disappear, heed my words. But he's certain about two things which it contained:
en.wikipedia.org/wiki/Asian_fetish#History_of_origins
In the United States, women of East and Southeast Asian descent are sometimes stereotyped as subservient, passive, mysterious, villainous in nature, and hyper-sexual.
subservient, passive, mysterious are understandable. But Hyper-sexual and villainous? OMG have these people never seen real Asians?
en.wikipedia.org/wiki/Asian_fetish#Pornography:
Several studies have implied that Asian women are over-represented in the American pornography industry. Asian women make up perhaps 20% of all female performers, despite being roughly 2.5% of the U.S. population. Asian men also appear to be considerably over-represented, at 10% of male actors.
Video 1.
How my boyfriend CHEATED with another Asian girl by Jenny Tian
. Source.
Video 2.
Sam Rockwell monologue about being an Asian girl on The White Lotus
. Source.

There are unlisted articles, also show them or only show them.